I claim: 

1 . A method for tracking the transmission of a digital file over the Internet 
comprising the steps of: 

receiving packets constituting segments of the file in transit over the Internet; 
. examining file headers in said packets to determine the presence of specific 
identifying indicia therein; and 

recording the Internet Protocol header source address for each of the packets 
containing said specific identifying indicia. 

2. The method of claim 1, including the additional step of recording the Internet 
Protocol header destination address for the file. 

3. The method of claim 1, including the additional step of transmitting said 
identifying indicia and said source Internet address to a proprietor of the file. 

4. The method of claim 1, including the additional step of transmitting said 
identifying indicia and said source Internet address to a remote site. 

5. The method of claim 1, wherein said examining step further includes: 

searching said file headers for TCP headers containing port numbers 
indicative of an email message; 

searching each of said packets, in which port numbers indicative of email 
messages were found, for an attachment; and 

when said attachment is found, locating the source Internet address in an 
IP header for the file containing the attachment. 

6. The method of claim 1, wherein said identifying indicia comprises a user- 
defined character sequence selected from the group consisting of: 

an extension to an existing file format, prepended to the file; 
a sequence of bits embedded in the file; and 
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an absence of code in a predefined area within the file. 

7. A system for tracking an Internet transmission of a digital file containing 
identifying indicia in a file header, the system comprising: 

a server which receives the file; 

a router which routes packets comprising the file to a next Internet leg in 
the transmission path of the file; and 

a monitor, connected between said server and said router, which processes 
packets constituting segments of the file; 

wherein said monitor is programmed to: 

examine file headers in said packets to determine the presence of 
said identifying indicia therein; and 

record the source Internet address for said file for each of the 
packets containing said identifying indicia. 

8. The system of claim 7, wherein said monitor is further programmed to: 

search said file headers for TCP headers containing port numbers 
indicative of email messages; 

search each of said packets, in which port numbers indicative of email 
messages were found, for an attachment; and 

locate the source Internet address in an IP header for the file containing the 
attachment. 

9. The method of claim 7, wherein said identifying indicia comprises a user- 
defined character sequence selected from the group consisting of: 

an extension to an existing file format, prepended to the file; 

a sequence of bits embedded in the file; and 

an absence of code in\a predefined area within the file. 
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10. A system for tracking an Internet transmission of a digital file containing 
identifying indicia in a file header, the system comprising: 
a modem which receives the file; 
a server for processing the file; and 

a monitor, connected between said modem and said server, which 
processes packets constituting segments of the file; 
wherein said monitor is programmed to: 

examine file headers in said packets to determine the presence of 
said identifying indicia therein; and 

record the source Internet address for said file for each of the 
packets containing said identifying indicia. 



11. A method for tracking the transmission of a digital file over the Internet 
comprising the st^ps of: 
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receiving packets constituting segments of the file in transit over the 



Internet; 

examining file headers in said packets to determine the presence of said 
identifying indicia therein; and 

recording, for each of the packets containing said identifying indicia, the 
source Internet address for the file. 

12. The method of claim 11, wherein said examining step further includes: 
searching said file headers for TCP headers containing port numbers 
indicative of email messages; 

searching each of said packets, in which port numbers indicative of email 
messages were found, for a MIME header indicative of an attachment; and 
when said MIME header indicative of an attachment is found: 

searching a header directly prepended to the file to find said 
identifying indicia therein, when said MIME header is indicative of an 
attachment containing a type of said file sought; and 
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locating the source Internet address in an IP header for the file 
containing the attachment, when said identifying indicia is found. 

13. The method of claim 1 1 , wherein said identifying indicia comprises a user- 
defined character sequence selected from the group consisting of: 

an extension to an existing file format, prepended to the file; 

a sequence of bits embedded in the file; and 

an absence of code in a predefined area within the file. 

14. A method for tracking the transmission of a digital file over the Internet 
comprising the steps of: 

placing identifying indicia in said digital file; 

using a data communications monitoring device to capture packets of information 
being transmitted via the Internet; 

examining certain ones of said packets to determine the presence of said 
identifying indicia in said file; and 

recording the source and destination Internet addresses for each of the packets 
containing said identifying indicia, and the identity of the file associated therewith. 

15. The method of claim 14, wherein said identifying indicia is prepended to said 

header. 

16. The method of claim 14, wherein said identifying indicia is embedded in said 

file. 

17. A method for tracking the transmission of a digital file over the Internet 
comprising the steps of: 

receiving packets constituting segments of the file in transit over the Internet; 

searching said packets for TCP headers containing port numbers indicative 
of email messages; 

searching each of said packets, in which said port numbers indicative of 
email messages were found, for a MIME header indicative of an attachment; and 

when said MIME header indicative of an attachment is found: 
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searching a header directly prepended to the file to locate said 
identifying indicia therein, when said MIME header is indicative of an 
attachment containing a type of said file sought; 

locating the source Internet address in an IP header for the file 
containing the attachment containing the type of said file sought, when said 
identifying indicia is located; and 

recording, for each of the packets containing said identifying 
indicia, the source Internet address for the file. 

18. The method of claim 17, including the additional step of transferring said 
identifying indicia and said source Internet address to a proprietor of the file. 

19. The method of claim 18, including the additional step of transferring 
additional information in said file to the proprietor of the file. 

20. A system for tracking an Internet transmission of a digital file containing 
identifying indicia in a file header, wherein said file comprises a plurality of packets 
constituting segments of the file, the system comprising: 

a server for receiving the file; 

a router for routing packets comprising the file to a next Internet leg in the 
transmission path of the file; and 

monitoring means, connected between said server and said router, for 
examining file headers in said packets to determine the presence of said 
identifying indicia therein; and 

means for recording the source Internet address for said file for each of the 

packets containing said identifying indicia. 
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21. The system of claim 20, wherein said monitoring means further comprises 
searching means for: 

locating said file headers for TCP headers containing port numbers 
indicative of email messages; 

locating each of said packets, in which port numbers indicative of email 
messages were found, for an attachment; and 

locating the source Internet address in an IP header for the file containing 
the attachment. 

22. A method for tracking the transmission of a digital file over the Internet 
comprising the steps of: 

receiving packets constituting segments of the file in transit over the 
Internet; 

searching said packets for an MPEG Layer 3 header prepended to the file; 

searching said MPEG Layer 3 header for identifying indicia located 
therein, if said MPEG Layer 3 header is located; 

locating the source Internet address in an IP header for the file containing 
said identifying indicia, if said identifying indicia is located; and 

recording, for each of the packets containing said identifying indicia, the 

source Internet address for the file. 

23. The method of claim 22, wherein said identifying indicia is located in a 
header having a field indicating that the frame size thereof is zero bytes in length. 

24. The method of claim 22, wherein said identifying indicia is located in a 
header having a frame size field indicating mat there is no information field appended to 
the frame size field. 
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25. The method of claim 22, wherein said identifying indicia comprises a user- 
defined character sequence located in the 'frame ED' and 'flags' fields of an ID3v2 frame 
header. 

26. The method of claim 22, wherein said identifying indicia comprises a user- 
defined character sequence selected from the group consisting of: 

an extension to an existing file format, prepended to the file; 

a sequence of bits embedded in the file; and 

an absence of code in a predefined area within the file. 
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